Subject: [spfbis] [Technical Errata Reported] RFC7208 (4082)

From: RFC Errata System <[email-masked]>
Date: Wed, 13 Aug 2014 16:13:06 -0700 (PDT)

The following errata report has been submitted for RFC7208,
"Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=7208&eid=4082

--------------------------------------
Type: Technical
Reported by: D. Stussy <[email-masked]>

Section: 8.7

Original Text
-------------
...  If the message is rejected during the SMTP transaction for
this reason, the software SHOULD use an SMTP reply code of 550
and, if supported, the 5.5.2 enhanced status code ...

Corrected Text
--------------
...  If the message is rejected during the SMTP transaction for
this reason, the software SHOULD use an SMTP reply code of 550
and, if supported, the 5.7.8 enhanced status code ...

Notes
-----
5.5.2 refers to responses where there's an SMTP COMMAND syntax error.
5.7.8 refers to messages where authentication credentials are invalid.

5.7.8 is a better description for rejecting an unauthorized message due to the
application of invalid authentication credentials such as bad syntax in an SPF DNS record.

The author of this errata notes that the IANA is showing a pending addition to
the enhanced codes to add SPF-specific error code 5.7.24 (in lieu of 5.5.2 or
5.7.8), but currently sees no valid RFC proposing it.  The draft is located at:
http://tools.ietf.org/html/draft-ietf-appsawg-email-auth-codes-07

The use of 5.5.2 here is misleading since the source of the error is not the
SMTP command stream.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7208 (draft-ietf-spfbis-4408bis-21)
--------------------------------------
Title               : Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1
Publication Date    : April 2014
Author(s)           : S. Kitterman
Category            : PROPOSED STANDARD
Source              : SPF Update
Area                : Applications
Stream              : IETF
Verifying Party     : IESG

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 13 Aug 2014 19:30:34 -0400

5.7.8 talks about things like incorrect password issues. That's not the kind of authentication at work for SPF.  SPF is more strictly about authorization,  not authentication. 

This should be rejected. 

Scott K

---

From: Barry Leiba <[email-masked]>
Date: Thu, 14 Aug 2014 09:30:06 -0400

Personally, I think 5.7.1 is the right code, until the email-auth-codes
draft (which is in the RFC Editor queue) pops out.  5.5.2 seems wrong to
me, as well.

That said, it's quite clear that what's in the document is what the working
group intended, and it's not a valid errata report.  I will mark it
Rejected.

Barry

On Wednesday, August 13, 2014, Scott Kitterman <[email-masked]> wrote:

> 5.7.8 talks about things like incorrect password issues. That's not the
> kind of authentication at work for SPF. SPF is more strictly about
> authorization, not authentication.
>
> This should be rejected.
>
> Scott K
>
> On August 13, 2014 7:13:06 PM EDT, RFC Errata System <
> [email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>>
>> ------------------------------
>>
>> ------------------------------
>>
>> Type: Technical
>> Reported by: D. Stussy <[email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>>
>>
>> Section: 8.7
>>
>> Original Text
>> -------------
>> ------------------------------
>>
>> ------------------------------
>>

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 14 Aug 2014 11:35:14 -0700

> "Sender Policy Framework (SPF) for Authorizing Use of Domains in Email,

I disagree.  5.7.8 specifically refers to AUTH (as in SMTP AUTH, RFC 4954 I
believe) in its definition.  SPF failures have nothing to do with AUTH.

-MSK